IN THE CLAIMS 

1 . (Currently Amended) A method for detecting abnormal traffic at a network level 
using a statistical analysis, the method comprising the steps of: 

a) gathering local traffic data from each network device and integrating a plurality of the 
local traffic data to generate traffic data in the network level by a single traffic sensing module; 

b) extracting a characteristic traffic data based on the traffic data in the network level; 

c) comparing the characteristic traffic data with a predetermined characteristic traffic data 
profile resulting from statistical computations and representing normal traffic, and determining 
whether there is abnormal traffic in the network; 

d) updating the predetermined characteristic traffic data profile using the characteristic 
traffic data if there is no abnormal traffic in the network, and analyzing a volume amount of the 
abnormal traffic and monitoring the abnormal traffic if there is abnormal traffic in the network; 
and 

e) transmitting the analysis result of the s e riousn e ss volume amount of the abnormal 
traffic to an abnormal traffic processing system to detect abnormal traffic without operation of a 
network manager, and processing the abnormal traffic to prevent a network failure. 

2. (Original) The method as recited in claim 1 , wherein the characteristic traffic data 
includes: 

information on traffic assigned to an application port which is selected according to an 
application service; 

information on traffic of which packet size is identical; and 

information on traffic of which the number of source-destination pairs, which represents 
the number of source addresses of the traffic having the same target address. 

3. (Cancelled) 
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4. (Currently Amended) A computer-readable recording medium for storing a 
program that implements a method for detecting abnormal traffic at a network level using a 
statistical analysis, the method comprising the steps of: 

a) gathering local traffic data from each network device and integrating a plurality of the 
local traffic data to generate traffic data in the network level by a single traffic sensing module; 

b) extracting a characteristic traffic data based on the traffic data in the network level; 

c) comparing the characteristic traffic data with a predetermined characteristic traffic data 
profile resulting from statistical computations and representing normal traffic , and determining 
whether there is abnormal traffic in the network; 

d) updating the predetermined characteristic traffic data profile using the characteristic 
traffic data if there is no abnormal traffic in the network, and analyzing a volume amount of the 
abnormal traffic and monitoring the abnormal traffic if there is abnormal traffic in the network; 
and 

e) transmitting the analysis result of the s e riousn e ss volume amount of the abnormal 
traffic to an abnormal traffic processing system to detect abnormal traffic without operation of a 
network manager, and processing the abnormal traffic to prevent a network failure. 
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